We hold CookieCal to the same requirements used by the FTC's COPPA Rule and leading children's-privacy certification programs — including kidSAFE+ and iKeepSafe. We are pursuing formal certification. Here is how we meet each standard today.
11standards met today
1in active progress
Key:
✓ Met= implemented & verified in code
◐ In Progress= partially implemented; completing now
→ Committed= planned; not yet shipped
Click any row to see exactly how we implement that standard and how we verified it.
◐ What's In Progress
Verifiable parental consent (under-13 accounts):Our current flow uses parental attestation via a consent checkbox. Under COPPA's strict definition, "verifiable" consent for under-13 accounts requires an additional mechanism — such as a signed consent form, a payment transaction, a knowledge-based question, or video authorization. We are evaluating requiring a payment card verification step at account creation (before any child profile is created) as the primary mechanism. This is our highest compliance priority.
Formal Safe Harbor certification: We are in the process of applying to an FTC-approved COPPA Safe Harbor program. This is an ongoing process that runs in parallel with everything above.
What we are not claiming
We are notclaiming to be "certified," "approved," or "endorsed" by kidSAFE, iKeepSafe, or any other body.
We are not displaying any certification seal, trustmark, or logo because we have not yet earned them.
We are not providing legal advice. This page is a transparency disclosure, not a legal certification.
We are not claiming that our current practices satisfy every requirement of every state privacy law — there are nuances across 15+ states beyond COPPA that require qualified legal review.
Additional protections built into CookieCal
🚫
No stranger contact — ever
Every connection to a child's account (caretakers, Cheer Squad) is created and controlled by the parent. Children cannot be contacted by anyone the parent hasn't explicitly invited.
🐾
Pet never punishes
The virtual pet never shows a "neglect" or guilt state. No dark patterns designed to pressure children into returning to the app or manipulate their behavior.
📊
Parent sees everything
Mood check-ins, journal entries, AI chat conversations, and photos are all visible in the parent dashboard. No secret spaces for minors.
🎛️
Parents control every feature
Feature toggles let parents enable or disable Chat, AI, Pet, Allowance, Journal, and Calendar views independently per child.
🌿
Season Mode — no punishment for life
When a family is going through a hard time, Season Mode pauses streaks and pressure without losing data or penalizing the child.
🛡️
Content moderation on uploads
Uploaded photos are scanned for inappropriate content before storage. Safety alerts are generated for parents when concerning patterns appear in chat or journal content.
🗑️
TAKE IT DOWN Act compliance
Reported non-consensual imagery is reviewed and removed within 48 hours. CSAM is reported to NCMEC immediately as required by federal law.
🏫
No student emails required
Classroom Mode never requires student email addresses. Students join by code. No student data is shared with home accounts without explicit parent consent.
🏫 For Schools & Districts
CookieCal Classroom Mode is designed to operate under FERPA's school official exception when a formal Data Privacy Agreement (DPA) is in place. Student data from Classroom Mode is never shared with home accounts without parent consent, never used for advertising, and never shared with other districts or third parties.
To request a DPA or discuss district-level data agreements: hello@cookiecal.com
💬
Questions about our safety practices?
We're a small team and we read every message. If you're a parent, educator, researcher, or journalist with questions about how we protect children's data, reach out directly.
Honest gap statement:This page reflects the standards we hold ourselves to and is not a legal certification or legal advice. The standards map is accurate to the best of our knowledge as of July 2026, but does not cover every state-specific nuance across the 15+ states with children's privacy laws beyond COPPA. We are pursuing formal review by a children's-privacy / ed-tech attorney and by FTC-approved Safe Harbor certification programs. Nothing on this page constitutes a legal opinion, and this page should not be relied upon as a substitute for qualified legal counsel.